CVE-2015-8964

The CVE-2015-8964 entry relates to the Linux kernel prior to 4.5, where the tty_set_termios_ldisc() function in drivers/tty/tty_ldisc.c can allow local users to read a tty data structure and disclose kernel memory. Evidence in connected documents confirms the affected component (tty_ldisc.c), the...

CVE-2016-0723

CVE-2016-0723 is a Linux kernel race condition in the tty_ioctl handler (drivers/tty/tty_io.c) that can allow a local attacker to obtain memory content or trigger a denial of service by manipulating a TIOCGETD call during a TIOCSETD operation. The initial description states the flaw exists in ker...

CVE-2016-7914

The CVE-2016-7914 issue affects the Linux kernel prior to 4.5.3. The vulnerable component is assoc_array_insert_into_terminal_node in lib/assoc_array.c, which does not verify whether a slot is a leaf. This can allow a local user to read kernel memory or trigger a denial of service (invalid pointe...

CVE-2017-5897

CVE-2017-5897 involves an out-of-bounds read in the Linux kernel’s IPv6 GRE handling (ip6_gre.c, ip6gre_err). Connected sources (Debian DSA-3791-1 and Cloud Foundry USN-3265-2) confirm the issue and note mitigation via kernel updates (e.g., Debian Jessie fix in linux 3.16.39-1+deb8u1; vendor advi...

CVE-2019-19525

CVE-2019-19525 affects the Linux kernel prior to 5.3.6, where a use-after-free can be triggered by a malicious USB device via drivers/net/ieee802154/atusb.c (CID-7fd25e6fc035). The vulnerability has an availability impact and a MEDIUM base score (CVSS v3.1: 4.6) with LOCAL/PHYSICAL factors descri...

CVE-2021-4093

CVE-2021-4093 : A flaw in the KVM AMD SEV-ES code allows a malicious VM using SEV-ES to trigger out-of-bounds reads/writes in the host kernel via a VMGEXIT with a string I/O instruction (e.g., outs/ins) using exit reason SVM_EXIT_IOIO. This can crash the host or enable a guest-to-host escape. Aff...

CVE-2023-47233

CVE-2023-47233: Linux kernel brcm80211/brcmfmac use-after-free in brcmf_cfg80211_detach during USB hotplug unplug. Root cause: escan_timeout_worker accesses cfg after brcmf_cfg80211_detach frees it. Fix: cancel the escan timeout timer and cancel the worker in brcmf_cfg80211_detach before freeing ...

CVE-2023-52501

The connected MiracleLinux advisory confirms CVE-2023-52501 affects the Linux kernel ring-buffer code. The issue occurs when iterating a live ring buffer: if the last event sits at the end of a page with only 4 bytes left, the event length check can misread the length (first 4 bytes, or the lengt...

CVE-2023-52686

CVE-2023-52686 involves a Linux kernel vulnerability where a null pointer check is missing in powerpc/powernv opal_event_init() and kasprintf() can return NULL on allocation failure. Exploitation could lead to a denial of service via NULL pointer dereference; this has been addressed with a kernel...

CVE-2023-52867

CVE-2023-52867 affects the Linux kernel drm/radeon driver: a buffer overflow in the AFMT status buffer (afmt_status, size 6) can occur because afmt_idx is checked after access. The issue is resolved in kernel updates referenced by multiple advisories (e.g., Amazon Linux 2 ALAS-2025-2834 and Unity...

CVE-2023-52878

CVE-2023-52878 : Linux kernel vulnerability in can_put_echo_skb() where out-of-bounds access to can_priv::echo_skb could crash the kernel. The fix enforces a bounds check and, on out-of-bounds access, issues a warning and returns an error instead of crashing. Affected component: CAN networking pa...

CVE-2023-52973

The CVE-2023-52973 issue affects the Linux kernel’s vc_screen path (vt/vc_screen.c). Root cause: a use-after-free of vc_data after console_unlock() in vcs_read(), where the vc_data pointer was loaded inside the loop, allowing a UAF in vcs_size(). The bug was fixed by moving the vc_data load to th...

CVE-2024-24855

CVE-2024-24855 describes a race condition in the Linux kernel’s SCSI lpfc_unregister_fcf_rescan() function that can cause a NULL pointer dereference, potentially leading to a kernel panic or denial of service. The vulnerability is tied to the kernel’s SCSI device driver (lpfc) and is referenced a...

CVE-2024-35870

CVE-2024-35870: In the Linux kernel, smb2_reconnect_server() can UAF a session being torn down by another thread, leading to a crash (general protection fault) when a session is in an inconsistent state. The root cause is a race where a session could be accessed after __cifs_put_smb_ses() begins ...

CVE-2024-35934

The CVE-2024-35934 issue affects the Linux kernel net/smc subsystem. Affected component: smc_pnet-related code in net/smc (pnet IDs list creation). Root cause: excessive RTNL (rtnl) lock pressure during net namespace/pnet initialization, caused by smc_pnet_create_pnetids_list() acquiring rtnl in ...

CVE-2024-35959

CVE-2024-35959 is an Linux kernel issue fixed in the mlx5e path. The fix addresses a cleanup flow: when mlx5e_priv_init() fails, mlx5e_priv_init’s cleanup calls mlx5e_selq_cleanup, which previously could lead to a misordered lock usage. The cleanup calls mlx5e_selq_apply() that assumes priv->s...

CVE-2024-36028

CVE-2024-36028: Linux kernel mm/hugetlb vulnerability fixed. The issue caused DEBUG_LOCKS_WARN_ON(1) during dissolve_free_hugetlb_folio(), leading to a kernel warning and panic. Connected sources attribute the root cause to a field packing problem where folio.deferred is unioned with folio._huget...

CVE-2024-36922

CVE-2024-36922 affects the Linux kernel’s iwlwifi driver (iwl_txq_reclaim) where txq->read_ptr could be read without holding the lock, allowing a race that can reclaim the same entry twice and trigger a WARN_ONCE, potentially causing a service disruption. The issue is fixed by reading txq->...

CVE-2024-38570

CVE-2024-38570 affects the Linux kernel GFS2/glock handling during DLM lockspace release on unmount. The issue was that glocks not intended to be unlocked could be freed and the lockspace released, while asynchronous callbacks (asb/bast) remained active, risking access to deallocated objects. The...

CVE-2024-40978

CVE-2024-40978 affects the Linux kernel, specifically a qedi/scsi path vulnerability. The root cause is qedi_dbg_do_not_recover_cmd_read() calling sprintf() on a __user pointer, which can crash the kernel. The fix uses a small local stack buffer for sprintf() and then copies with simple_read_from...

CVE-2024-41056

CVE-2024-41056 concerns the Linux kernel firmware path: cs_dsp fixes a potential overrun in V1 wmfw file name fields. The underlying issue is that algorithm and coefficient name strings live in fixed-size, NUL-terminated arrays and strlen could overruns when the NUL terminator is missing. The pat...

CVE-2024-41063

In CVE-2024-41063, the Linux kernel Bluetooth stack (hci_core) fixes a deadlock when unregistering a device. The root cause involves hci_unregister_dev() racing with hci_error_reset() and hdev->req_workqueue/destroy_workqueue(), where pending work items may still be running during destroy. The...

CVE-2024-41066

CVE-2024-41066 affects the ibmvnic driver in the Linux kernel. The publicly documented fix addresses a memory-leak risk during transmit: the driver previously assigned skb pointers to tx_buff entries without verifying that the target address was unused/null. If free_map and tx_buff became out of ...

CVE-2024-42131

CVE-2024-26929 is rejected/not used; this CVE entry is not an active vulnerability.

CVE-2024-49930

In CVE-2024-49930, the Linux kernel vulnerability concerns the ath11k Wi-Fi driver. The hal_reo_error array in ath11k_soc_dp_stats is sized to DP_REO_DST_RING_MAX, but ath11k_dp_process_rx() indexed this array using the SRNG REO destination ring ID, which is not a normal ring ID and led to out-of...

CVE-2024-49935

CVE-2024-49935 involves the Linux kernel ACPI PAD path (exit_round_robin) where a crash can occur in cpumask_clear_cpu() due to clear_bit(nr) with nr = 0xffffffff and misaligned memory access. The fixed issue, as documented, is to validate tsk_in_cpu[tsk_index] != -1 before calling cpumask_clear_...

CVE-2024-49938

Linux kernel CVE-2024-49938 affects the ath9k_htc wifi driver. The issue arises from skb_trim() being used on an uninitialised skb length in error paths, leading to an invalid urb reset before resubmission. The patch switches to __skb_set_length(skb, 0) (which already calls skb_reset_tail_pointer...

CVE-2024-50008

Technical details about CVE-2024-50008 are not publicly provided in the connected documents. The initial description mentions a Linux kernel fix related to mwifiex, but no concrete affected products/versions/root cause or remediation are given here. Monitor for updates.

CVE-2024-50024

CVE-2024-50024 pertains to the Linux kernel. The issue is an unsafe loop on a kernel linked list used when deleting a genetlink family that may still have listeners. The result could be an Oops—kernel access of a bad area—potentially crashing the kernel. The root cause is iteration with element r...

CVE-2024-53222

Concretely, CVE-2024-53222 affects Linux zram: the zram_add() path can dereference NULL for zram->comp_algs[ZRAM_PRIMARY_COMP] if comp_algorithm_set() hasn’t run yet. The fix moves the necessary setup earlier (ahead of device_add_disk()) so the zram device is ready before users can access it v...

CVE-2024-53227

CVE-2024-53227 concerns a Linux kernel use-after-free in bfad_im_module_exit() triggered by a double release path. The issue occurs when bfad_init() calls bfad_im_module_init() and on error path executes ext: bfad_im_module_exit(); followed by a second fc_release_transport, causing a use-after-fr...

CVE-2024-57913

CVE-2024-57913 concerns the Linux kernel USB gadget subsystem (functionfs_bind) where a race between adb/UDC paths could trigger a kernel panic when panic_on_warn is enabled. The issue stems from an unnecessary WARN_ON in functionfs_bind, leading to a crash during function binding in configfs/gad...

CVE-2025-21934

CVE-2025-21934 : In the Linux kernel, the rapidio Rio driver had an API misusage where rio_add_net() could pathologically free resources when device_register() failed. The patch fixes this by using put_device() instead of kfree() and by nulling mport->net to avoid a use-after-free. Impact is l...

CVE-2017-14340

CVE-2017-14340 affects the Linux kernel prior to 4.13.2. The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h does not verify that a filesystem has a realtime device, enabling a local user to trigger a NULL pointer dereference and OOPS when setting the RHINHERIT flag on a directory. The issue re...

CVE-2017-8831

The CVE-2017-8831 issue affects the Linux kernel, specifically the saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c, with impact up to kernel version 4.11.5. It is a local, potentially privilege-escalating vulnerability described as a “double fetch” vulnerability caused by re-r...

CVE-2019-12615

CVE-2019-12615 affects the Linux kernel (SPARC) in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c prior to/through version 5.1.6, due to an unchecked kstrdup_const of node_info->vdev_port.name that can trigger a NULL pointer dereference and system crash. This is a DoS vulnerability as de...

CVE-2019-19037

CVE-2019-19037 affects the Linux kernel ext4 implementation: ext4_empty_dir in fs/ext4/namei.c up to kernel 5.3.12 can trigger a NULL pointer dereference when ext4_read_dirblock(inode,0,DIRENT_HTREE) evaluates to zero. Connected Nessus advisories (Unity Linux UTSA-2026-003782/003750/001396) echo ...

CVE-2020-35499

CVE-2020-35499 describes a NULL pointer dereference in Linux kernel versions prior to 5.11 due to a missing sanity check in sco_sock_getsockopt (net/bluetooth/sco.c) when using BT_SNDMTU/BT_RCVMTU for SCO sockets. The issue allows a local attacker with elevated privileges to crash the system or l...

CVE-2022-48939

CVE-2022-48939 refers to a Linux kernel issue where the BPF subsystem’s batch operations could cause soft lockups due to missing schedule points. The fix adds scheduling points in batch paths to prevent long hangs (e.g., kworker/1:1:27 blocked and hung RCUs). The root cause is that batch processi...

CVE-2022-49872

CVE-2022-49872 affects the Linux kernel net/gso code. A bug in skb_segment when GRO packets have a frag_list with mixed head allocation types could trigger a BUG_ON, due to an incorrect assumption that the first list_skb member’s head_frag reflects all members. The issue arises because skbs on th...

CVE-2023-52624

CVE-2023-52624 concerns the Linux kernel’s drm/amd/display path where the DMCUB must be awake before issuing GPINT commands. The root cause is that GPINT mailbox access could occur while DMCUB is idle, risking a system hang. The documented fix adds a wake/execute/sleep wrapper via the function dc...

CVE-2023-52643

CVE-2023-52643: Linux kernel iio subsystem memleak in iio_device_register_sysfs_group on failure to free iio_dev_opaque->chan_attr_group.attrs. The MiracleLinux AXSA advisory confirms the patch and remediation via updated kernel, with no exploitation details provided. Upgrade to a kernel versi...

CVE-2023-52672

A regression in the Linux kernel (introduced by commit c73be61cede5 ) can cause resized pipes to lock up under specific conditions. The issue occurs because the wakeup for pipe->wr_wait is triggered before pipe->max_usage is actually increased. If a pipe is full prior to the resize, the wak...

CVE-2023-52707

CVE-2023-52707: Linux kernel sched/psi use-after-free in ep_remove_wait_queue() can occur when a non-root cgroup is removed while a thread is polling a pressure file; the polling thread may access a freed waitqueue during file close/exit, causing a use-after-free. The issue is rooted in cgroup_fi...

CVE-2023-52811

The Linux kernel contains a vulnerability in the scsi: ibmvfc driver. The issue stems from a historical BUG_ON flag in the ibmvfc_get_event() function which was triggered when an event pool was empty. If the kernel was not configured to crash on panic, this would return a junk event pointer, lead...

CVE-2024-26629

CVE-2024-26629: Linux kernel nfsd: fix RELEASE_LOCKOWNER. Connected advisories document a patch correcting a test on so_count in nfsd4_release_lockowner(), which could transiently report locks held and cause NFS4 errors. The fix reverts to check_for_locks() (made to not sleep) and prevents false ...

CVE-2024-26680

CVE-2024-26680—Linux kernel (net/atlantic): The issue arises in the Atlantic driver’s PTP HWTS ring. aq_ring_hwts_rx_alloc() allocates extra DMA memory for the HWTS ring, but aq_ring_free() did not account for that extra size, causing a mismatch between mapped and unmapped DMA regions (trace show...

CVE-2024-26740

CVE-2024-26740: In the Linux kernel, the net/sched act_mirred fix uses the Rx backlog for egress→ingress reversals to prevent socket lock deadlocks on certain redirect scenarios. The upstream patch ca22da2fbd69 implements this backlog-based handling; Nessus advisory AXSA references this CVE with ...

CVE-2024-26919

CVE-2024-26919 affects the Linux kernel USB ULPI driver. The root cause is a debugfs directory name mismatch: the ULPI per-device debugfs root is named after the ulpi device’s parent, while ulpi_unregister_interface attempts to remove a directory named after the ulpi device itself. This causes th...

CVE-2024-26978

The CVE-2024-26978 entry relates to a Linux kernel issue: creating a max14830 I2C device from userspace could trigger a NULL pointer dereference in max310x during I2C instantiation. The fix adds a validity check for the devtype and aborts the probe with a clear error message. Connected advisories...